## Pt. 1We get an email file (.eml) and the challenge is to find out what was deleted from the file...
```Received: from 10.197.33.204...Return-Path: <[email protected]>X-Originating-Ip: [209.85.221.45]Received-SPF: pass (domain of gmail.com designates 209.85.221.45 as permitted sender)Authentication-Results: ...X-Apparently-To: [email protected]; Fri, 15 Apr 2022 06:03:02 +0000X-YMailISG: ...Received: from 209.85.221.45...Received: by mail-wr1-f45.google.com with SMTP id u3so9536261wrg.3...DKIM-Signature: ...X-Google-DKIM-Signature: ...X-Google-Smtp-Source: ABdhPJyaUwECUfiVnHLMvCVoOGSDlrFjphDMOXwSo8pSUztrUcs+gK7lHOKWwReyKsHGHeQG13Psbc5aQ2asjRuWTvE=X-Received: by 2002:a05:6000:1564:b0:20a:7727:27b0 with ...MIME-Version: 1.0From: crew ctf <[email protected]>Date: Fri, 15 Apr 2022 08:02:49 +0200Message-ID: <CAG+6dK2LBZJeWOCXgSp_JnxShdjjkuoXpcxp3ChSLQ6dfkUjZQ@mail.gmail.com>Subject: Help me!To: [email protected]Content-Type: multipart/alternative; boundary="000000000000c0332a05dcab29d2"Content-Length: 677
--000000000000c0332a05dcab29d2Content-Type: text/plain; charset="UTF-8"
Hey, crushed kiwi I hate this loop of college, and I need your help. Canyou meet me at lost immediately?
--000000000000c0332a05dcab29d2Content-Type: text/html; charset="UTF-8"Content-Transfer-Encoding: quoted-printable
...
--000000000000c0332a05dcab29d2--```
I realized that it has to be from a google email so I sent myself an email and compared both.The `X-Gm-Message-State:` Header is missing!
This was the solution for the first part of the challenge.