Why does preview change the ctime of a pdf, and how can I disable it?
The filesystem and metadata can change when preview has write access to the file. The precise why is probably complicated, but you can prevent it by removing write access (chmod a-w test.pdf) and then using preview on the file. Note, the chmod updates the ctime as well.



My guess is that metadata fields like kMDItemUsedDates and kMDItemLastUsedDate are the reason for ctime being updated. You can use mdls test.pdf to check those details before and after your tests.