Deterministic recovery of a file system built on a thinly provisioned logical volume having redundant metadata

A file server comprising:

• physical data storage;
• and
• at least one data processor coupled to the physical data storage for accessing the physical data storage;
• wherein said at least one data processor is programmed for maintaining a sparse metavolume of the physical data storage, the sparse metavolume includes slices of the physical data storage allocated to the sparse metavolume, the sparse metavolume provides logical data storage, some of the logical data storage is mapped to the slices of the physical data storage allocated to the sparse metavolume, some of the logical data storage does not have allocated physical storage and is not mapped to the slices of the physical data storage allocated to the sparse metavolume, and the sparse metavolume has slice metadata defining the allocation of the slices of the physical data storage to the sparse metavolume and the mapping of the logical data storage to the slices of the physical data storage that are allocated to the sparse metavolume, and
• wherein the file server stores three copies of the slice metadata, and said at least one data processor is programmed with a recovery procedure executable by the said at least one data processor to recover from a disruption by comparing the three copies of the slice metadata to detect and correct errors in the slice metadata,
• wherein each slice of physical data storage allocated to the sparse metavolume includes a slice mark containing a respective portion of the slice metadata defining allocation of said each slice to the sparse metavolume and mapping of the logical data storage of the sparse metavolume to said each slice, a first one of the three copies of the slice metadata is comprised of the respective portions of the slice metadata in the slice marks of the slices of physical data storage allocated to the metavolume, the slice marks are chained together by links, and the recovery procedure is executable by said at least one data processor to recover from the disruption by following the links to collect the slice metadata contained in the slice marks,
• wherein a second one of the three copies of the slice metadata is maintained in one of the slices allocated to the sparse metavolume, and
• wherein a third one of the three copies of the slice metadata is stored in a kernel mode database separate from the slices of the physical data storage allocated to the sparse metavolume.