hide the location of the downloadable files. then make users request the file like:
www.yoursite.com/download.php?filename=image.jpg
in the download.php script set the header to the appropriate file, readfile() the real file, and increment something in the mysql database that logs the downloads. something like: UPDATE download_logs SET downloads = downloads + 1 WHERE filename = "image.jpg".
if the files are in the web root then the users can't download without requesting the file using the download.php page. personally i'd use id numbers and not filenames to avoid users requesting download.php?filename=/etc/passwd or something and store the actual filenames in the mysql database.