I don't think this is covered in the FAQ or previous entries in the forums.  I'm using V5.3 of Cforms II and there seems to be an error in the file attachments / upload logic.  The copy to the server directory is only triggered if database tracking is on – a quick scout of the PHP would seem to confirm this:

Line 1237: cforms.php

The copy is within the database update logic, and I can't find any other route to the copy.  Maybe this is expected behavior, but it took me a little while to track it down.  I've made my own edits, but figured this might be a bug…

BTW – the forms has saved me tons of time – nice work!

Steve