Opening a PDF Without Leaving a Single Trace on macOS [Devlog #9]

Source: Dev.to

Background

All tests were run on an 8‑year‑old MacBook Air.
When a PDF is opened on macOS, the operating system silently records the file in at least five locations:

• Recent Documents (NSDocumentController)
• Finder’s recent items (LSSharedFileList)
• Application cache directory
• QuickLook thumbnail cache
• Rendering cache under ~/Library/Caches/

How macOS Registers Opened Files

macOS automatically registers opened files via NSDocumentController.
By overriding this behavior on the Swift side, the recent‑document entry can be suppressed:

@implementation HiyokoSanctuaryDocument

- (void)addToRecentDocuments {
    // intentionally empty
}

+ (BOOL)autosavesInPlace {
    return NO;
}

@end

Sanctuary Viewer – Zero‑Trace PDF Viewer

The viewer keeps all data in memory and deletes any temporary files when it is closed.

pub struct SanctuaryViewer {
    page_cache: HashMap>, // example cache type
    temp_files: Vec,
}

impl Drop for SanctuaryViewer {
    fn drop(&mut self) {
        // Delete any temp files on close
        for path in &self.temp_files {
            let _ = std::fs::remove_file(path);
        }
        // Zero out in‑memory cache
        self.page_cache.clear();
    }
}

The Drop implementation fires the moment the viewer closes, so no manual cleanup is required.

Avoiding QuickLook Caching

macOS runs QuickLook in the background and writes thumbnails to ~/Library/Caches/com.apple.QuickLook.thumbnailcache automatically.
The fix is to never pass the file path to QuickLook. All rendering is performed through the internal Ghost Engine in memory, so the file path never reaches any macOS API that would trigger caching.

Usage

1. Open a PDF with Sanctuary Viewer.
2. Close the viewer.

From macOS’s perspective, the file was never opened—no recent‑document entry, no Finder history, and no thumbnail cache.

Download

Hiyoko PDF Vault

---

Follow the project on Twitter: @hiyoyok