This is my research on how the K2 attachments work and where it uploads the files.

When simple attaching

• attachemnts are stored here /public_html/media/k2/attachments/
• all in one folder
• there is a php download link betweeen you and the file, however it probabaly could be guessed if the file name is known

When attaching a file already on the server

• it adds using a root based url  -  /images/kb/2016/home-xxxxx-grid/Home-xxxxx-Grid-Icons.zip
• relative links seem to work images/kb/2016/home-feature-grid/Home-xxxxx-Grid-Icons.zip
• when you delete a manually added file it leave it on the server
• when manually adding a file you must make sure you give it a title otherwise you will not get a download link
  when you insert an attachment that is already on the server, k2 copies it to the attachment folder.

Both

• you cannot alter the titles after inserting the file