My question was re. the file attributes; i.e., time/date stamps, permissions, etal..

If you simply edited the "bad" file, or copied over it with a "good" one, then there's no easy way to even know when it was changed, which makes it exceeding difficult to determine by whom it was changed.

In cases like this, I first rename the "bad" file to something like, in this case, proftpd_BAD.conf prior to replacing it with a good copy, so as to have a record of the file attributes.