That's a great question, and I assume you're asking because the answer doesn't seem obvious (e.g. the developer docs are missing a chart of the storage structure). I might be able to figure this out once I get to my laptop and can SSH into my server. But, assuming they're stored as attachments, it seems like they may be in in data/internal_data/... according to this post. Sorry for not being able to give a more definitive answer so far.
Update: I was able to log in and look around on my server and it's confusing. I see some files in \internal_data\xfmg\original but not the thousand I'd expect to see. I downloaded some sample files from data\attachments and I definitely see the thumbnail of an image I uploaded to the media gallery but I haven't found the full size yet.