Thanks Ken. I removed all of those and freed up some space but only a fraction of what I lost.
I've actually put a workaround in place until I can do a proper tidy up of making the moodle course backups go to another drive that I added to the virtual machine today.
To clean up longterm I'm thinking of getting an output of all the file hashes for a site from the filedir directory and doing a comparison with all the hashes from the database in mdl_files. Any that aren't in the database should in theory be able to be deleted as moodle has no reference for them but that's a job for a few weeks time when I'm back from leave!