diff --git a/recover_bad_signature.sh b/recover_bad_signature.sh
index 81c3d07..f33d01f 100755
--- a/recover_bad_signature.sh
+++ b/recover_bad_signature.sh
@@ -360,11 +360,19 @@ validate_recovered_file() {
          if [[ "$_head8o" = "d0cf11e0a1b11ae1" ]] ; then
             echo "VALID|OLE2/CFBF container signature ok - this is a password-protected Office file (encrypted package), not a plain zip, so the zip check does not apply; open it with the password to verify content"
          elif command -v unzip > /dev/null 2>&1 ; then
-            if unzip -tq "$_f" > /dev/null 2>&1 ; then
+            # Use a 120-second timeout: unzip -tq on a very large or partially
+            # corrupt ZIP can block indefinitely otherwise (the process simply
+            # stalls in I/O, unlike a clean CRC error which exits quickly).
+            local _unzip_exit
+            timeout 120 unzip -tq "$_f" > /dev/null 2>&1
+            _unzip_exit=$?
+            if [[ $_unzip_exit -eq 0 ]] ; then
                echo "VALID|zip integrity ok"
+            elif [[ $_unzip_exit -eq 124 ]] ; then
+               echo "UNVERIFIED|zip integrity check timed out after 120 s (file may be very large or corrupt; check manually with: unzip -t \"$_f\")"
             else
                local _badentry
-               _badentry="$(trim "$(unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
+               _badentry="$(trim "$(timeout 120 unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
                echo "INVALID|zip integrity check failed${_badentry:+ (${_badentry})}"
             fi
          else
diff --git a/recreate_bad_signature.sh b/recreate_bad_signature.sh
index e29bbb0..b4196cc 100755
--- a/recreate_bad_signature.sh
+++ b/recreate_bad_signature.sh
@@ -386,11 +386,19 @@ validate_recovered_file() {
          if [[ "$_head8o" = "d0cf11e0a1b11ae1" ]] ; then
             echo "VALID|OLE2/CFBF container signature ok - this is a password-protected Office file (encrypted package), not a plain zip, so the zip check does not apply; open it with the password to verify content"
          elif command -v unzip > /dev/null 2>&1 ; then
-            if unzip -tq "$_f" > /dev/null 2>&1 ; then
+            # Use a 120-second timeout: unzip -tq on a very large or partially
+            # corrupt ZIP can block indefinitely otherwise (the process simply
+            # stalls in I/O, unlike a clean CRC error which exits quickly).
+            local _unzip_exit
+            timeout 120 unzip -tq "$_f" > /dev/null 2>&1
+            _unzip_exit=$?
+            if [[ $_unzip_exit -eq 0 ]] ; then
                echo "VALID|zip integrity ok"
+            elif [[ $_unzip_exit -eq 124 ]] ; then
+               echo "UNVERIFIED|zip integrity check timed out after 120 s (file may be very large or corrupt; check manually with: unzip -t \"$_f\")"
             else
                local _badentry
-               _badentry="$(trim "$(unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
+               _badentry="$(trim "$(timeout 120 unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
                echo "INVALID|zip integrity check failed${_badentry:+ (${_badentry})}"
             fi
          else
diff --git a/restore_bad_signature.sh b/restore_bad_signature.sh
index 09e20d7..9ec6063 100755
--- a/restore_bad_signature.sh
+++ b/restore_bad_signature.sh
@@ -380,11 +380,19 @@ validate_recovered_file() {
          if [[ "$_head8o" = "d0cf11e0a1b11ae1" ]] ; then
             echo "VALID|OLE2/CFBF container signature ok - this is a password-protected Office file (encrypted package), not a plain zip, so the zip check does not apply; open it with the password to verify content"
          elif command -v unzip > /dev/null 2>&1 ; then
-            if unzip -tq "$_f" > /dev/null 2>&1 ; then
+            # Use a 120-second timeout: unzip -tq on a very large or partially
+            # corrupt ZIP can block indefinitely otherwise (the process simply
+            # stalls in I/O, unlike a clean CRC error which exits quickly).
+            local _unzip_exit
+            timeout 120 unzip -tq "$_f" > /dev/null 2>&1
+            _unzip_exit=$?
+            if [[ $_unzip_exit -eq 0 ]] ; then
                echo "VALID|zip integrity ok"
+            elif [[ $_unzip_exit -eq 124 ]] ; then
+               echo "UNVERIFIED|zip integrity check timed out after 120 s (file may be very large or corrupt; check manually with: unzip -t \"$_f\")"
             else
                local _badentry
-               _badentry="$(trim "$(unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
+               _badentry="$(trim "$(timeout 120 unzip -t "$_f" 2>&1 | grep -v '^Archive:' | grep -v '^[[:space:]]*$' | head -1)")"
                echo "INVALID|zip integrity check failed${_badentry:+ (${_badentry})}"
             fi
          else