have customer want to know who deleted his top level sites ( aka site collection ).
the easy answer is the one site collection admin or the user have full control permission at your site collection!!
But let say have 100 site collection admin!!! ha ha..so which one is the one??
oh yeah easy to trace is go to the IIS log file then search it at the folder level:
A word or phrase in the file with
“/sites/<sites collection name>/_layouts/deleteweb.aspx ”.
yeah!!! shoot the one delete it!!! ha ha