Both Refresh Points and System Recovery features in Windows 8 can be used to remove malicious and corrupted files. W. Kenneth Johnson has published some notes from his research about Windows 8 forensics and where you can find a good explanation about various artifacts related to these two features.
Read more here – http://randomthoughtsofforensics.blogspot.co.uk/2012/05/windows-8-refresh-excerpt.html