Ok, back to this then:
If everything reports open then what ports do you focus on first?
I don't see an issue here. An attacker would be overwhemed with choise and excitement so that he wouldn't be able to decide which port to choose first, get stuck for a several months unable to decide? He'd toss a coin then.
My ports are always open for you, my son. And doors, and windows.
You can’t pretend-close it and still have that service work.
indeed, a service on a port would no longer properly work. However, pretending that an open port is closed is possible the same way when pretending that's open
Do you youself understand what you're talking about?
then focus on those ports with more expensive/slower scans to find out what is running on those ports.
What do you mean by "focus on those ports"? What are "more expensive/slower scans"?
If everything reports open
not every port gets reported to be open but only some of them
what ports do you focus on first?
me? or an attacker? he could work with any ports he wishes
"I don’t want to encypt them in-place because I’ll be uploading them onto a server, copying them on an external drive."
I don't want to encypt them in-place because I'll be uploading them onto a server, copying them on an external drive.
but an attacker isn't obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him