The RecoveryMode is located at
/Firmware/all_flash/all_flash.(MODEL-NAME).production/(RECOVERYMODE-IMG4-FILE-NAME).im4p in the IPSW. The RecoveryMode logo is flashed to NOR (or a functionally equivalent partition) and displayed when the device is in Recovery Mode.
It is an iBootim image with an alpha channel packed into an IMG4 (.im4p) archive. On 32 bit devices, it is a raw image packed into an IMG3.
Due to limited firmware storage space, any custom recovery mode logo must be exactly 320x480 and under 100 KB. Custom Recovery Mode logos are not supported on devices not vulnerable to the 0x24000 Segment Overflow, Alloc8 Exploit or Pwnage 2.0.