By default Citavi saves a project's attached files in the Citavi Attachments folder. This folder is a subfolder of the folder in which the project file is located.
You can find instructions here.
In the Path for attachments field, you can see where Citavi is saving all the files that you attach to the project. The path can only be changed with the Citavi DBServerManager.