I haven't done it myself, but if you are running Apache then look into mod_rewrite
It is pretty much the only way (I think?) to divert requests for images and whatnot to a PHP file.
In that PHP file you can do all the processing you want (e.g.: check for session security to see if they are authorized to view/download the image/file or maybe just update a view/download counter) and then output the proper content-type header()'s and then readfile() the file you want to serve
If I was more familiar with mod_rewrite, then I'd throw out the proper rule to put in your httpd.conf or .htaccess ... maybe someone else has the exact recipe needed