How to deal with /system/files references when upgrading to D7?
Why it happens

In D6, the system module provides the following menu entry that ties system/files to the file_download callback:

In system_menu() function:

  $items['system/files'] = array(
    'title' =&gt; 'File download',
    'page callback' =&gt; 'file_download',
    'access callback' =&gt; TRUE,
    'type' =&gt; MENU_CALLBACK,
  );


Then in file_download(), if the file exists and no hook_file_download() objects to the download, it gets served.

On the other hand, D7 expands on that with a page argument set to private:

  $items['system/files'] = array(
    'title' =&gt; 'File download',
    'page callback' =&gt; 'file_download',
    'page arguments' =&gt; array('private'),
    'access callback' =&gt; TRUE,
    'type' =&gt; MENU_CALLBACK,
  );


It has the effect of preprending the private:// scheme to the filename, which file_download processes by requesting the registered file stream wrapper for  it.
By default (no private path set in /admin/config/media/file-system), this scheme is not registered, and that's why GET /system/files/logo.png finally fails with a 404 status.

How to fix

Setting the private file system path to sites/default/files (the same as the public path) makes it work.

However it's not a good long term fix, both because routing public static files through Drupal is much heavier than direct access by httpd, and because it precludes the use of a real private space should the site need it in the future.

The long term fix is to hunt for these /system/files/xyz references and replace them by /sites/default/files/xyz.