Just to follow up ... include info not included before ...
The area I was watching was moodledata/temp/backup/ then a contenthash named directory that was re-created by the backup process 'plan' which was trying to handle those 7000 videos - recyclebin phase of something deleted. Recyclebin process makes a backup of whatever was deleted.
Inside moodledata/temp/backup/xxxysyysyasdfasdds/ a 'files' directory kept being re-created and populated.
That directory had same structure as moodledata/filedir/ and so I used another linux command ... file -b path/to/file to discover they were all videos. In Windows file browser, surely there would be something one could use to select a file then look at mimetype. No regular icon for windows would show in the OS for a file that doesn't have a filename extension.
Dunno if what you are seeing is exactly the same, but kinda sounds like it ... maybe!
Good luck!
'SoS', Ken