The concept you're referring is to is called red pill detection.. The bad guys have gotten wise to the fact that the good guys can easily put a malware in a virtual sandbox to do dynamic analysis, so some are building in red pill action. For common hypervisors, doing a simple driver check will show whether the guest is running on vmware, xen, or other hypervisors.
This has little impact on forensics. Any good forensics investigator will have resources to do analysis outside a VM environment. Simply, using a VM guest (i.e. automation) to do malware analysis simplified forensics for the good guys. Not all malware does detection today. Considering the bad guys usually prefer to keep packages small, embedding additional functions like vm detection adds additional complexity to code. Such detection may only be present when the bad guys are really concerned about being detected. Since most malware packages target the lowest hanging fruit (which there are plenty of), additional features (i.e. encryption, vm detection, steganography, etc) really aren't necessary. So, existing models of automating forensics are still effective.