In the Validated module list, you'll find a link to the applicable security policy. In the security policy, §2.3 describes the platforms on which the certification applies: it lists several versions of Windows, with no reference to any particular hardware. Then §6 describes usage requirements that must be met in order for the certificate to apply. One of the FIPS-compliant startup mechanisms listed in §5.2 must be in use, therefore the machine must have a PIN pad, a USB connection or a TPM. The policy does not explicitly describe the connection between the machine running Windows and these peripherals, therefore a virtual machine would be acceptable.

A virtual thumb drive would be a different matter. As there is no actual USB involved, I don't think the language can be construed to cover this case.

How meaningful is Bitlocker then? I'll argue it's still useful. Bitlocker (if it meets its security requirement) still protects secrets against any attacker that's confined in the virtual machine.

But the fact that Bitlocker is FIPS 104-2 level 1 compliant does not in itself mean that Bitlocker is particularly secure. As you can see by reading the security policy, what you have is a superficial evaluation that Bitlocker implements cryptographic algorithms correctly, takes some slight care not to leak key material, and has a vaguely decent high-level architecture. That's all. You would have to go a higher in the certification hierarchy (FIPS 104-2 level 2, or Commom Criteria with a decent EAL) to get some security assurance. And even then, what you get is just that: some assurance, not a guarantee of perfect security.

In the Validated module list, you'll find a link to the applicable security policy. In the security policy, §2.3 describes the platforms on which the certification applies: it lists several versions of Windows, with no reference to any particular hardware. Then §6 describes usage requirements that must be met in order for the certificate to apply. One of the FIPS-compliant startup mechanisms listed in §5.2 must be in use, therefore the machine must have a PIN pad, a USB connection or a TPM. The policy does not explicitly describe the connection between the machine running Windows and these peripherals, therefore a virtual machine would be acceptable.

A virtual thumb drive would be a different matter. As there is no actual USB involved, I don't think the language can be construed to cover this case.

How meaningful is Bitlocker then? I'll argue it's still useful. Bitlocker (if it meets its security requirement) still protects secrets against any attacker that's confined in the virtual machine.

But the fact that Bitlocker is FIPS 140-2 Level 1 compliant does not in itself mean that Bitlocker is particularly secure. As you can see by reading the security policy, what you have is a superficial evaluation that Bitlocker implements cryptographic algorithms correctly, takes some slight care not to leak key material, and has a vaguely decent high-level architecture. That's all. You would have to go a higher in the certification hierarchy (FIPS 140-2 Level 2, or Commom Criteria with a decent EAL) to get some security assurance. And even then, what you get is just that: some assurance, not a guarantee of perfect security.