Review comments are stored in the database, specifically in the article_comments table. Note that other general article comments are also stored in that table, so if you export the table you would have to filter the generic comments out. I believe that all review comments are comment_type 1.
If you are using custom review forms, I believe the form comments are stored differently, in the review_form_responses table.
Any review *files* that the reviewer uploads can be found in the files directory, eg in files/journals/1/articles/40/submission/review, where "1" is the journal number and "40" is the submission ID.