The attachments are stored in a directory on the Mendix server. The Mendix DB holds a reference to the file in the document/image object.

If you run your app locally, you will find a deployment directory. In this directory you will find a data directory that again contains a files folder. Your attachments will be stored here.

Note: If you create/restore a backup without files this means that the application still holds the reference, but you cannot view/download files because the reference is pointing nowhere.