A method of storing data in a non-volatile memory for the redundant storage and recovery of metadata, the method comprising: receiving a first write request to write first user data (udata_jM) to a first logical address; receiving a second write request to write second user data (udata_kM) to a second logical address; determining a first memory location of the non-volatile memory, addressed using a first physical address at which to store the first user data (udata_jM), wherein the first physical address is mapped from the first logical address; programming at the first memory location: a first metadata; and the first user data (udata_jM); characterised in that the method comprises: determining a second memory location of the non-volatile memory, addressed using a second physical address at which to store the second user data (udata_kM), wherein: the second memory location is based on a geometric relationship with the first memory location, such that the geometric relationship defines the second memory location as a predetermined one of eight adjacent locations relative to the first memory location when the memory locations of the non-volatile memory are represented graphically in two-dimensional or three-dimensional space; and programming, at the second memory location the first metadata associated with the first user data (udata_jM); a second metadata associated with the second user data (udata_kM); and the second user data (udata_kM) in the non-volatile memory, wherein: the first metadata comprises at least one of the first logical address, flags and other data associated with the first user data (udata_jM); and the second metadata comprises at least one of the second logical address, flags and other data associated with the second user data (udata_kM); and the first metadata is redundantly stored at the first and second physical addresses (302, 352) such that there is a one-to-one mapping between the first memory location addressed by the first physical address and the second memory location addressed by the second physical address. receiving a first write request to write first user data (udata_jM) to a first logical address; receiving a second write request to write second user data (udata_kM) to a second logical address; determining a first memory location of the non-volatile memory, addressed using a first physical address at which to store the first user data (udata_jM), wherein the first physical address is mapped from the first logical address; programming at the first memory location: a first metadata; and the first user data (udata_jM); a first metadata; and the first user data (udata_jM); determining a second memory location of the non-volatile memory, addressed using a second physical address at which to store the second user data (udata_kM), wherein: the second memory location is based on a geometric relationship with the first memory location, such that the geometric relationship defines the second memory location as a predetermined one of eight adjacent locations relative to the first memory location when the memory locations of the non-volatile memory are represented graphically in two-dimensional or three-dimensional space; and the second memory location is based on a geometric relationship with the first memory location, such that the geometric relationship defines the second memory location as a predetermined one of eight adjacent locations relative to the first memory location when the memory locations of the non-volatile memory are represented graphically in two-dimensional or three-dimensional space; and programming, at the second memory location the first metadata associated with the first user data (udata_jM); a second metadata associated with the second user data (udata_kM); and the second user data (udata_kM) in the non-volatile memory, the first metadata associated with the first user data (udata_jM); a second metadata associated with the second user data (udata_kM); and the second user data (udata_kM) in the non-volatile memory, the first metadata comprises at least one of the first logical address, flags and other data associated with the first user data (udata_jM); and the second metadata comprises at least one of the second logical address, flags and other data associated with the second user data (udata_kM); and the first metadata is redundantly stored at the first and second physical addresses (302, 352) such that there is a one-to-one mapping between the first memory location addressed by the first physical address and the second memory location addressed by the second physical address.