Everything hinges on using undocumented commands to look into the transaction log. I’ve played with this before on the blog: fn_dblog.
First off I created a script to create a database, populate a table and then drop it.
USE master;
GO
CREATE DATABASE FnDbLogTest;
GO
USE FnDbLogTest;
GO

CREATE TABLE TestTable (
c1 INT IDENTITY,
c2 CHAR (100) DEFAULT ‘a’);
GO
CREATE CLUSTERED INDEX TT_CL ON TestTable (c1);
GO
INSERT INTO TestTable DEFAULT VALUES;
GO

SELECT OBJECT_ID (‘TestTable’);
GO

DROP TABLE TestTable;
GO 
First we need to find the transactions that drop tables in the log. The following code works for 2000, 2005, and 2008:
SELECT [Transaction Id], [Begin Time], [UID], [SPID]
FROM ::fn_dblog (NULL, NULL)
WHERE [Transaction Name] = ‘DROPOBJ’
GO 
The (NULL, NULL) is the starting LSN and ending LSN to process – NULL means process everything available. 
Results on SQL Server 2000 will look as follows for me logging in as a Windows login in the SA role:
Transaction Id Begin Time              UID         SPID
————– ———————– ———– ———–
0000:000000e0  2009/06/16 18:23:03:320 1           51
And for the same circumstances on 2005 and 2008, the results look like:
Transaction Id Begin Time               UID         SPID
————– ———————— ———– ———–
0000:00000587  2009/06/16 17:49:56:927  -1          51
If the user who dropped the table logged in as a role member, and they’re not connected as that SPID any more, you may not be able to tell who it was unless you’re also tracking successful logins into your server – but you’ll at least know what role it was.
Now, this only shows us that a table was dropped, not which table it was. There’s no way to get the name of the table that was dropped, only the object ID – so you’ll need to have some other way to determine what the table ID is if there are multiple table drops and only one of them is malignant.
For SQL Server 2000, the code to find which object ID we’re talking about is as follows (dropping the Transacation Id into the WHERE clause):
SELECT DISTINCT [Object Name] FROM ::fn_dblog (NULL, NULL)
WHERE [Transaction Id] = ’0000:000000e0′
AND [Context] = ‘LCX_IAM’;
GO

Object Name
——————–
(2009058193)
The object ID in parentheses is the ID of the table that was dropped. 
For SQL Server 2005 and 2008, the code is as follows (with the same Transaction Id substitution):
SELECT TOP (1) [Lock Information] FROM ::fn_dblog (NULL, NULL)
WHERE [Transaction Id] = ’0000:00000587′
AND [Lock Information] LIKE ‘%SCH_M OBJECT%’;
GO

Lock Information
——————————————–
ACQUIRE_LOCK_SCH_M OBJECT: 8:2073058421:0
The 8:2073058421 is the database ID and object ID of the table that was dropped.