When a website is opened in Internet Explorer and the URL is dragged from the address bar onto the Windows' desktop, an icon is created. The image of this icon in most cases looks like the website's favicon. These icons persist even after IE cache has been deleted. Where and how Windows OS stores these icons?
Windows is surprisingly sneaky here: it stores the favicon image using an NTFS Alternate Data Stream as a child of the .url file.
The stream-name is Pages.url:favicon:$DATA.
This is documented in the MS-FSCC specification.
Obviously this only works on NTFS, whereas I distinctly remember desktop .url shortcuts having favicons when I was using Windows 98 (which used FAT, not NTFS) - I don't know how it worked on Windows 9x.