Memory system managing map data based on risk of malware—infection of host, and operating method thereof

Abstract

A memory system includes: a memory device including: a first memory block storing first map data, which maps a first logical address to a first physical address; and a second memory block storing first user data corresponding to the first map data; and a controller configured to: receive a warning signal from a host; and back up the first map data as second map data in response to the first logical address being provided along with a write command received after the warning signal is received; update the first map data to map the first logical address to a second physical address; suspend an erase operation being performed on the first user data is invalidated due to the write command; and restore the first map data based on the second map data and validate the invalidated first user data when it is determined that the host is infected by malware.