Converting all the PDFs to some more "passive" format - maybe TIFF or postscript - could be done in batch, in a restricted account either on the local machine or on some linux box/VM. An exploit/malware being carried along into a different file format is very unlikely. Files that are purely malicious will not even render that way; any exploit targeted at popular PDF viewers probably will not work with scripted conversion tools (which will mostly be based on the ghostscript engine); and the restricted account will keep a successful exploit from doing much damage. A normal user account on an up-to-date linux machine is very difficult to "break out of" - do make sure that this machine doesn't have unregulated internet access though, since network access is the hardest to control. If disclosure of the contents of the valid PDFs would have dire consequences, make sure only one PDF at a time is accessible to the account running the interpreter at a given time (eg by copying the file into a staging location from yet another user account, running the interpreter via su/sudo (not sudo to root!), then taking the result file away. Rinse, repeat. Oh, and: Keep the original files away from any (especially Windows) PCs that are set up to do previews of files in Explorer, in email clients or similar frontends!