Hi Ken
I may be wrong but it sounds like you may have taken offence at my "shudder", no offence was meant. I simply did not want to encourage to idea of placing a potentially unknown file in a web accessible location. It doesn't matter how well a machine is protected, the fact that you are able to access a remote Moodle install means it is not isolated and only an isolated machine is ever "safe" for such an activity. Part of the knowledge of how to protect systems you mention (to me) would be not pointing a web browser at an unknown file.
I have been using Moodle for around 10 years, but only managing this for the last 2. A lot of these issues stretch back for several years as they were not viewed as an issue when the system was small. As a consequence, while the every day management of Moodle is no problem, sometimes I come across something like this where I could use some community advice. I have over 20 years Linux experience, running first on an old Slackware that was installed via floppy disks using Kernel 1.3, so yes, I know how to safely run things, but in that knowledge is also the realisation that nothing is "truly" safe, and some things are best left not done.
Moving on however, I know these are backup files from Moodle 2.x+. We moved from 1.9 a long time before these files were made so they are files that could potentially be restored. However, while in theory these files probably could be restored they never would be if they are draft status and noone (including the user who created them) can access them. Having them "missing" ill not cause a problem. My question really was more about the best way to safely delete them and if there is anywhere else apart from mdl_files that has references that should be deleted. I certainly don't want to delete the files and not have their entries removed from the DB as I will come across them again and again when looking for large files even after they are gone.
Cron had no hiccup, it has run fine with no errors every day.
For the student submissions, I totally agree - there is no point keeping them. However when tutors do not reset their assignments and students get removed from their course page at the end of the year, their submissions are still present but cannot be seen/accessed as the student is no longer in the course so doesnt appear in the list of students for that assignment. The tutors then do not see that there are submissions still present. I would (like I do with Turnitin) force removal of all assignments so they have to be recreated if needed next year but Moodle assignments are often used on courses that straddle up to 3 years and they want the students to be able to see all the submissions they have made during the course - so the assignments cant be blanked each year. There are other reasons for this as well.
What is needed really for student submission, is a tool to remove all submissions where the student is no longer registered on the course that submission was for - for longer than a period of time. I suspect that a similar thing - delete the file and mdl_files entry is the only option - or moosh if it can handle this specific scenario is probably the best way to go.
Thanks to both of you for your suggestion of moosh however, this seems to be the best way of dealing with these from what I see so I will give this a go.
Regards
Tim Gildersleeve
VLE Manager
Bradford College