I'm doing some testing with fsautility and the -b function. It is consistently restoring files with modify dates precisely 4 (or 5) hours older than the timestamps that were on the placeholders. After some spot checking of files in the vault versus the equivalent placeholders on my CIFS share, everything in the vault is consistently 4 or 5 hours older than the equivalent placeholder timestamp.
It's worth noting that these placeholders have all been migrated from a Windows file server to a CIFS share on a NetApp. I don't know if this is relevant point or not.
I've checked the clock settings on my EV server and they're correct, as is the timezone.
I don't know whether this is an EV issue or not. Could it be the placeholder migration (fsautility -pm) I did back in November?