First, it is important to make a distinction between the two types of files needed to run MESS systems. BIOS files contain code that exists in ROM chips built into the system unit, therefore they are always needed regardless of what software you want to run. The term "software" encompasses files containing any other data to be run on the system, for example dumps of ROM cartridges (so-called "ROMs") or images of floppy disks.
Ideally, these files should be obtained by "dumping" the original data yourself, for example with an EPROM programmer or a serial cable connected to the original system. However, many people have already done this work, so BIOS files and software images are widely available on the Internet. It is important to remember, however, that both BIOS files and software images are subject to copyright law and it is illegal to download or have dumps of systems or software that you do not own genuine physical copies of (with the exception of software freely distributed by its authors, for example "homebrew" games).
It is also worth noting that MESS expects BIOS files to be "pure"; in other words straight dumps from the ROM chips. Other emulators may concatenate files together or may prefix some kind of header. For this reason, BIOS files from the Internet may not work unless they are specifically intended for use with MESS.
Zipped BIOS files are placed in the roms subfolder of your MESS folder, with filenames matching the short names of the systems. For example, your directory structure might look like this if you want to use the Apple ][, Color Computer 3, and Super NES drivers:
C:\MESS\roms\apple2.zip
C:\MESS\roms\coco3.zip
C:\MESS\roms\snes.zip
If the roms folder does not exist, create it.
It is recommended to leave these files zipped for neatness' sake, however MESS will also recognize the files if they are extracted to subdirectories, e.g. roms\coco3.zip could be extracted to roms\coco3\coco3.rom and roms\coco3\disk11.rom. Extracting the files into the roms folder itself will not work.
You can also put BIOS files elsewhere by changing the rompath option in mess.ini, see the help page "MESS Configuration Files" (or go to Options, Directories in the GUI).
Software images can be placed in similar subdirectories (e.g. software\coco3\MyCoolCocoGame.dsk). The GUI will first look for software images in this directory. However, placing software images here is not mandatory and one can tell the GUI to look for software images elsewhere, and when using the command line the full path to the images must be specified regardless.