Detectives have been given more time to question a man suspected of murdering "devoted family man" Lee Pomeroy, and a woman accused of assisting an offender.
The 35-year-old alleged killer was held after a manhunt led police to a flat in Willbury Road, Farnham, in the early hours of Saturday morning.
British Transport Police said on Sunday morning that investigators had been granted another 12 hours to question the man and woman, 27, who remain in custody.
Mr Pomperoy had been taking his son, 14, on a trip to London when he was stabbed to death in a "horrific and pointless attack" on Friday afternoon, police said.
The father, who would have turned 52 on Sunday, was described by his family as a "an honourable man and would always help somebody who was in trouble".
In a statement released by British Transport Police (BTP), Mr Pomeroy's family said: "Lee took his son on a trip to London hoping to spend some quality time with him which was cut short by an horrific and pointless attack.
"Lee would have had his birthday today but did not get to see his presents.
"He was an honest, bright person, who loved music very much.
"He knew history and art and he was a bachelor of science in maths.
"He was a devoted family man and did everything for his family.
"He was a loving husband and father. He will be deeply missed by all his family."
Mr Pomeroy lived in Guildford with his 50-year-old wife Svetlana Pomeroy and their teenage son.
The couple both worked for Datronix Systems Limited, an IT consultancy, where Mr Pomeroy is listed as a programmer and director.
Mr Pomeroy and his son boarded the 12.58 train service between Guildford and London Waterloo at London Road station on Friday afternoon alongside the suspected killer, described by police as a slim, black man in his 20s or 30s, who was approximately 6ft tall with a beard.
The men became locked in a three to four-minute row moving through the carriage and into another before this escalated into an "unprovoked, violent attack", police said.
The killer fled the train at Clandon station and headed in the direction of Dedswell Drive while the service continued to Horsley station where police and paramedics attended.
At 6am on Saturday a suspect was arrested on suspicion of murder at a flat near Farnham Hospital alongside a 27-year-old woman detained on suspicion of assisting an offender.
The woman who was arrested along with the suspect was identified by neighbours as Chelsea Mitchell.
Residents said she and her child lived at the flat with the suspect, who one described as "very moody".
Neighbour Grant Christy told reporters he witnessed the police breaking into the building, taking a couple into custody and leading a young child from the house.
He said: "At six they smashed the door down, woke me up immediately, obviously.
"Initially I just heard the banging. Sounded like someone trying to kick the door in, that's what it sounded like to start with. And then I jumped out of bed, put my ear to the door, listened to what was going on.
"Then I heard the police shouting, 'put your hands up, turn around', all that sort of thing and then it went quiet.
"They led her out first with the kid, barefoot, put her in a police wagon over there, then a few minutes later they pulled him out handcuffed."
Police said they are not looking for anyone else in connection with the killing.
Detectives are continuing to appeal for information and asked anyone who was on the train at the time or who has dash-cam footage of the Clandon area after 1pm on January 4 to get in touch as soon as possible.