Just talked to Support for ESRI AU. We both agreed the Scratch folder only hold the files for as long as necessary before they are added to the database and then removed when not needed, but in action its behaviours is different, and here is the prove:
I created a feature via the feature service on my ArcGIS online map, and added a photo attachment to feature. I could immediately see the photo in the scratch folder on the server. Next I renamed the photo on the server to see if I could download it from the serer to the iPad, and the answer is YES, which means the photo has been saved in the SDE database. So I rename the photo back to its original and waited for 24 hours to see it will be deleted, and this time the answer is NO, the photo is still right there and I can assure no one has touched it during the 24 hours.
The arcgisuploads.json file has maxfileage = 1440minutes (24hrs) by default, however seems this rule doesn't get applied because its parent folder configure (arcgisystem.json) has maxfileage = none.
Has anyone noticed the same issue? maybe you should check your '\arcgisserver\directories\arcgissystem\arcgisuploads\scratch' folder if you enabled attachment for your feature service.
Anyway I'm still asking for a solution, if anyone has please help. Thank you.