DLNA Question

If the 2000 is anything like a HDR-FOX, everything is driven by SQLite data tables, not XML. Even if there were an XML file, I know of no means by which you could gain access to it on anything other than HDR-FOX/HD-FOX.
Ok, but DLNA presents something to VLC to list the media that is available. I want to get at whatever that something is.
I'm not sure what else there is to say, I think you are assuming the Humax stuff is implemented the same way as a PC or something.

The (HDR-FOX) DLNA server is a blob of code within the Humax binary which receives DLNA media content requests and responds to them from its internal database. To construct that database it periodically (and particularly during the shutdown housekeeping) walks the Media folder tree looking for media files and adding them to the database. The equivalent of an "XML file" is the SQLite database (but I've already told you that). VLC composes the media list it presents to the user locally, from the responses to queries it gets from the DLNA server and however VLC wishes to present that information – it is irrelevant how the information is created, you don't get to see the source.

If the intention is that you want to grab the entire index, there is nothing to stop you compiling DLNA queries yourself and capturing the responses, but I guess you will have to parse the responses to request the deeper layers of the media tree. You might even find downloadable tools to help you do just that (eg UPnP Inspector). Bear in mind that the numeric .TS is assigned by the DLNA server when it walks the tree indexing media files, and does not exist anywhere else.
Thank you Black Hole.
The DLNA query bit, how might I do that? From the command line, so that I can use it programatically.
Either Google is your friend, or I suggest you use WireShark to snoop on existing transactions.
Thank you Black Hole.
The DLNA query bit, how might I do that? From the command line, so that I can use it programatically.
I tried to do something similar a few years ago. Eventually I found some documentation and Java libraries on github. The material is no longer supported and may be out of date. Search for 4thline and cling. I never found libraries for more popular programming languages or scripts. But I stopped looking when I found “cling”. Using cling libraries the query went, in very general terms, server x list items you have; wait for a network response to be sent asynchronously (may have to wait for multiple replies if a lot of files); read the response(s) which contain the filenames similar to those in the original question. Whether the responses are xml files I never determined as I didn’t dig into the libraries. It’s possible as a third party xml lib is referenced. Definitely more Google research required!
Funnily enough I was just looking around for your experiments. It's here (but I see the OP should be well aware of that anyway): https://hummy.tv/forum/threads/proposed-method-of-auto-decryption-on-hdr-2000t.6451

Whether the responses are xml files I never determined
If they are, then they are created dynamically by the server. I've done a little research, and it seems the DLNA specifications are not in the public domain (but when did that stop anybody). DLNA appears to be an extension of UPnP, which is more easily obtainable and should provide some insight.

All that is actually needed is to discover what the path and DLNA reference (ie the numeric .TS) is, once we have that the rest is easy. If we were able to extract the relevant .db file it could be interrogated, but of course we can't (or nobody has found a means). I did wonder whether the DLNA reference might be included in the .hmt, but it appears not.

I'll stick with my original suggestion: while snooping network transactions with WireShark, use a DLNA client to request a media listing from the server – again, UPnP Inspector might be a useful tool. Any information thus discovered is applicable in multiple domains, not only HDR-2000T (so therefore maybe somebody's already done it).