There are a number of ways in which such a system can work, and a number of reasons for using it. Some of the more common reasons are for security, as has been mentioned, but also for tracking purposes - it's more practical to store the number of times a file has been accessed through a tracking script than look through a log file to count the access attempts.
The ways in which it can work vary. It can be a unique file ID corrosponding to only that file which will then be looked up in the database, but that is more likely to be for tracking purposes than security reasons. If it was for security, it would more likely be a session hash or something else that uniquely identified you and the file you were seeking, rather than a simple file ID. So anyway, after the file is located, it will usually do one of two things: i) Redirect you to the location of the actual file (eg. header('Location: /file.mp3')), or ii) Get the contents of the file and send it to you directly. The latter is more commonly used in situations where security is a priority; if you are redirected to a direct download point, then you can obviously just use that URL again later and not have to go through the initial process.
Hope that helps.
Reply