Just to elaborate/summarize a little on Ken's post ..
Moodle stores files in the Moodle data directory. This is a location on your server defined by you when you install Moodle. You can check the location of that directory in the Moodle config.php file. But the key thing is really that Moodle manages access to files via its File API. And the data directory should not be accessible via the web. So its practically impossible to access those files without using the File API.
This is a feature because it means that access to the files is managed by the same permissions system that controls access to pages on the Moodle site. So a student could not guess the URL of a file that they should not have access to. It also means that files associated with a course or activity can be backed up and restored with the course and activity.
So become familiar with the FIle API if you need to work with files.