2.4. Upgrading Installations

2.4.1. General Concepts

  • We recommend you backup your data folder, just in case.

  • Make sure you update your EDR/AV with the new collector hash values. You can find those in the History.

  • Installers will remove their previous version.

Our upgrades are nearly always backward compatible:

  • If we ever make an incompatible upgrade, it will be a major version (i.e. v4 to v5).

  • Database schemas may get upgraded with a new version, but you can still open them with an older version.

  • If you add a host with a new version and try to open it with an older version, that may not work.

Specific instructions include:

2.4.2. Upgrading Standard

To upgrade Cyber Triage, simply run the new MSI. The previous version will be automatically uninstalled.

All settings will be retained. See Standard Installation.

2.4.3. Upgrading Team

When upgrading a Team Server, users can’t add or access data because the server will be down. So time the process accordingly.

The upgrade process depends on what version you are upgrading from and to.

2.4.3.1. Upgrading from v3 TO v4

The v3 to v4 process is notable because the Server installer now manages the service that Cyber Triage runs as. And, because v4 introduces a new dedicated Team client installer or web app option.

Server:

  • Backup your data folder

  • Note what account your Cyber Triage service currently runs as. You’ll need this during the new installation process.

    • GUI Method: Launch services.msc → find Cyber Triage Server Service → Properties → Log On tab.

    • Command Method: sc qc CyberTriageService

  • Launch the Server installer, as outlined in Cyber Triage Server Installation and be prepared to supply the above user account and its password.

Clients:

See Web Browser vs Installed Clients on deciding what type of client to use moving forward.

  • On each computer with a v3 installation, manually uninstall it.

  • Instruct users to start with the web application at https://SERVER:9443/app/.

  • They may need the thick client, which can be installed from within the app (see Install and Configure Cyber Triage Clients).

Notes on the new v4 thick client:

  • It cannot be configured to run in Standard Pro mode. You need the Standard installer to do that.

  • It does not require administrator privileges to install.

  • The MCP server path changed. You’ll need to update the MCP path to %LOCALAPPDATA%\Programs\CyberTriageTeamClient\bin\cybertriage-mcp-stdio.exe. Refer to Enable the MCP Server for details.

2.4.3.2. Upgrading FROM v4

Server: Once you already have a v4 Server, you simply need to:

  • Backup your data folder

  • Launch the new installer. It will re-use the existing service.

Clients:

  • Users using the web app need to do nothing.

  • Thick client installations need to be updated with each minor version (i.e. 4.1 to 4.2). They can get the new version from within the app. The new client will uninstall the previous version. See Install and Configure Cyber Triage Clients.

2.4.3.3. Manually Removing v3 Service

In v3, you needed to manually add and remove the service. To manually remove the v3 service:

  • Open an Admin command prompt and change to the v3 Cyber Triage service folder.
    cd C:\Program Files\Cyber Triage\cybertriage\service
  • Stop the v3 service:
    svcmgr stop
  • Remove the v3 service:
    svcmgr uninstall

  • Manually uninstall v3 (using the Windows Control Panel, etc.)