2.4. Upgrading Installations

2.4.1. General Concepts

When upgrading:

  • No Client Access: No one can access or ingest data

  • Previous Version is Removed: The installer will uninstall the previous version.

  • Good List the new Collector in your EDRs/AV: You should update your AV and EDR providers with the hash values of the new Collector. You can find those in the History.

  • Team Is Multi-Step: If you are running a Team cluster, remember to:

    • Restart the Server service.

    • Update the clients as well. Their settings will transfer from the previous version.

Specific instructions include:

2.4.2. Backward Compatibility

Our upgrades are nearly always backward compaatible.

  • If we ever make an incompatible upgrade, it will be a major version (i.e. v4 to v5).

  • Database schemas may get upgraded with a new version, but you can still open them with an older version.

  • If you add a host with a new version and try to open it with an older version, that may not work.

2.4.3. Upgrading Standard

To upgrade Cyber Triage, simply run the new MSI. The previous version will be automatically uninstalled.

All settings will be retained.

2.4.4. Upgrading Team

The process changes depending on what you are upgrading from.

2.4.4.1. Upgrading Team from v3 to v4

v4 was a significant shift for Team deployments for three main reasons:

  • The Server has its own installer now it directly deals with the service registration. This means you need to explicitly uninstall the old server and service.

  • Users can connect via web browser and do not need a thick client

  • Thick clients can be installed at the user level.

2.4.4.1.1. Upgrading a Service-based Server

If your existing server runs as a service, then you need to remove the service and the application.

  • Open an Admin command prompt and change to the v3 Cyber Triage service folder.
    cd C:\Program Files\Cyber Triage\cybertriage\service
  • Stop the v3 service:
    svcmgr stop
  • Remove the v3 service:
    svcmgr uninstall

  • Manually uninstall v3 (using the Windows Control Panel, etc.)

  • Make a backup of your existing data directory.

  • Refer to Team Account Requirements about new requirements for the service account.

  • Install the v4 Server installer. See Cyber Triage Server Installation.

2.4.4.1.2. Upgrading a Non-Service Server

If you did not configure your server to run as a service, then all you need to do is:

2.4.4.1.3. Upgrading Clients

If you sever has upgraded to v4, then you should manually uninstall the v3 clients.

Your users should now start with using their web browser and then download a thick client as needed. See Install and Configure Cyber Triage Clients.

If you install the v4 client for MCP usage, you’ll need to update the MCP path to %LOCALAPPDATA%\Programs\CyberTriageTeamClient\bin\cybertriage-mcp-stdio.exe. Refer to the Options Panel for details.