Time domain reflectometer looking for faults
I think your math is correct.
I also agree with the comments by @Math
The first reflection occurs at the first change in impedance (Z0 -&gt; Zdamage), and the second when at the end of the damage (Zdamage -&gt; Z0). I suppose you know how to calculate Gamma and that you know you are dealing with very small reflections that might be difficult to &quot;pin&quot;-point after attenuation and dispersion, but that is a practical matter and it isn't your question.
The reflection from the second impedance change is 60cm behind the first, or 2x 1.5ns = 3ns. Also note there will be more reflections than just those too. In fact, if you swept with a sinusoid you might see a peak in reflected amplitude (or an extreme max/min in impedance) proportionate to the length of the damage, attributed to a standing wave (albeit with poor quality) between the two impedance changes.
To obtain such fine time resolution with sub-sampled (fs=5ns) needle-pulses is of course not theoretically correct. However, your 200MHz scope which perhaps samples at 1Gsps, combined with dispersion applied to the pulses, might still provide you with reflections that can be compared in time.
If you have the possibility to apply a train of pulses, you can try using PN (pseudo-noise) sequences, even short sequences or sinusoids, and cross correlate to find the mutual delay. Or you could model the delay and perform a maximum-likelihood comparison with the shape of the received pulse.
The dispersion will in fact provide you with slopes, and sloped signals can have their delay estimated even if sub-sampled. If you have the equipment, you could take short captures and process them off-line.