Two men were spotted crossing a railway line shortly after a train driver was murdered in his locomotive, police said on Thursday.
Police spokesman Lt-Col Lungelo Dlamini said two cellphones had been stolen from the scene of the murder, "possibly by two men who were seen crossing a railway line after the train had stopped".
Train driver JP du Plessis was found stabbed to death in a stationary train outside Hercules station in Pretoria on Tuesday.
On Thursday, Dlamini said it appeared the driver had also been hit by a blunt object.
He said no arrests had been made yet but police were following several leads.
The Passenger Rail Agency of South Africa earlier issued a statement saying metrorail trains would not operate in Gauteng on New Year's Day in honour of Du Plessis.