If you put your form code in the DEFINE ThankYou section of a custom cart template, then you could put the order number in a hidden form field using the [-- ThankYouOrderNumber --] template tag as the value. There is no way to get the product SKU's via custom template tags, so you would have to get those into additional hidden form field values via JavaScript using the Shopping Cart JavaScript Variables feature of ShopSite Pro (you can also get the order number from this JavaScript), see the list of variables/arrays available through this ShopSite Pro feature in the docs at:
http://www.shopsite.com/help/10.2/en-US/sc/pro/cart.variables.html
As far as identifying the file uploaded, you could use a separate db for this, but I think using a db could be overkill, your upload script could just add the order number and SKU to the beginning of the filename of the uploaded file.
-Loren