Thanks for the reply - I'll have a look at the thread.
I've worked the problem out to be the automateed moodle backup files that were generated over the last few days. These aren't included in the database that is being restored so effectively I'm left with an additional 3 days of backups that it has no idea about so won't clean up when new automated backups are performed.
I've checked that the hashed values of files (a random sample - not all of them) don't exist in the database and that all matches up.
Obviously I can delete any files that were created in this window but am now wondering if there is a tool that will clean up files that do not exist in the moodle database or at least get a list of orphaned files that I can then script to delete?