Mount the image, using imageMounter.py or as you would a normal image.
Browser to the following location (for Windows 10 and recent versions)
C:\Users\<username>\NTUSER.DAT
C:\Windows\System32\config\SOFTWARE
C:\Windows\System32\config\SAM
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SYSTEM
After this, you can do a timeline analysis of the registry hives using log2timeline, or browse them manually with regedit or similar tools