We have several sites that are managed in multiple languages. Recently two of these have been deleted to the recycle bin causing a widespread out of hours crisis. The sites have simply been dragged and dropped back in the root structure, but we would like to be able to find out who deleted these files and what date/time.
At present i cannot figure a way to find out this detail. Version history merely gives me changes to the content of the site, not placement etc.
I don't think you can see that from a change log. I'm afraid that you cannot get that information.
You can however log it yourself next time it shows by hooking into the moved event or even do a check if the moved page is a start page and deny the move.
I do not think there is a tracking of this in the 5 version. The changlog in CMS 6 was added to facilitate this, so that you could see all changes made. But you could make your own by adding logging on the datafactory events. (move, create, delete)
In order to get the date/time of the event you could always check the SQL Server transaction log for the EPiServer content database (using a tool, like "ApexSQL Log" will help out). Both the tblPage & tblTree should be affected by the changes you describe (e.g. the tblPage.fkParentID column would be updated for the top page).
Regarding the user:
If you find the transaction specified above, you should also almost immediately before/after find a transaction affecting the "aspnet_Users"-table updating the "LastActivityDate"-column of the user performing the action. Be aware thought that this could be another user doing something else simultaneously, but you should be able to narrow the number of suspects down ;)