The RecoveryMode is located at
/Firmware/all_flash/all_flash.(MODEL-NAME).production/(RECOVERYMODE-IMG3-FILE-NAME).img3 in the IPSW. The RecoveryMode logo is flashed to NOR (or a functionally equivalent partition) and displayed when the device is in Recovery Mode.
It is a PNG picture with an alpha channel packed into an IMG3 archive.
Due to limited firmware storage space, any custom recovery mode logo must be exactly 320x480 and under 100 KB. Custom Recovery Mode logos are not supported on devices not vulnerable to the 0x24000 Segment Overflow or Pwnage 2.0.