Why does preview change the ctime of a pdf, and how can I disable it? When I open a file in Preview, preview updates the ctime of the file. This seems to only happen once however, and as far as I can tell, nothing other than the ctime is changing. This is very frustrating because it's messing with scripts that are checking for modification to the file, even when no modification is happening.

Below is an example of what I'm seeing. I create a new pdf file called test.pdf, everything looks good. Then I open it with Preview, do nothing, and close preview. Now the file has an updated access and change time, but not modified. As far as I can tell, everything else about the file is identical, it's as if the ctime was touched for no reason. This effect seems to be cached in some sense, because if I open it again, only the access time is updated.

$ stat -x test.pdf 
  File: "test.pdf"
  Size: 47737        FileType: Regular File
  Mode: (0644/-rw-r--r--)         Uid: ~~~  Gid: ~~~
Device: 1,3   Inode: 3220039    Links: 1
Access: Wed Jun 17 11:02:24 2015
Modify: Wed Jun 17 11:02:24 2015
Change: Wed Jun 17 11:02:24 2015
$ open test.pdf 
$ stat -x test.pdf 
  File: "test.pdf"
  Size: 47737        FileType: Regular File
  Mode: (0644/-rw-r--r--)         Uid: ~~~  Gid: ~~~
Device: 1,3   Inode: 3220039    Links: 1
Access: Wed Jun 17 11:02:39 2015
Modify: Wed Jun 17 11:02:24 2015
Change: Wed Jun 17 11:02:39 2015
$ open test.pdf 
$ stat -x test.pdf 
  File: "test.pdf"
  Size: 47737        FileType: Regular File
  Mode: (0644/-rw-r--r--)         Uid: ~~~  Gid: ~~~
Device: 1,3   Inode: 3220039    Links: 1
Access: Wed Jun 17 11:02:53 2015
Modify: Wed Jun 17 11:02:24 2015
Change: Wed Jun 17 11:02:39 2015


Is there any way to prevent preview from doing this, other than the naive copy the file first, and just look at the copy?
The filesystem and metadata can change when preview has write access to the file. The precise why is probably complicated, but you can prevent it by removing write access (chmod a-w test.pdf) and then using preview on the file. Note, the chmod updates the ctime as well.



My guess is that metadata fields like kMDItemUsedDates and kMDItemLastUsedDate are the reason for ctime being updated. You can use mdls test.pdf to check those details before and after your tests.