@agatha
Pretty much. go to social's cli can tell you where the media files are. To be careful you may want to turn off the server before making the copy; you should especially do this if using postgres but it's probably good to do for sqlite too, and it's not like the downtime is bad for a single user instance.
docs.gotosocial.org/en/v0.20.2/admin/backup_and_restore/#media