Let's first map out what each of these terms mean:
- Direct evidence: "proves or disproves a fact directly." It's common for direct evidence to take the form of eyewitness testimony, but this doesn't have to be the case. Real or documentary evidence can be direct evidence, too.
- Real evidence: used interchangeably with physical evidence, is "any evidence that is a tangible object, as opposed or oral testimony or documentary evidence, which records information that is offered as evidence." What's more, it's "used to prove a fact based on the characteristics of all or part of an object." For example, if I'm at a stoplight and I get rear-ended and my airbag deploys, the airbag would be an example of real evidence.
- Best evidence: "requires that an original or a highly accurate copy of a document or other object be brought into court."
Now to your question: Can a piece of evidence fall into all three categories?
Yes, and here's a (common) example. Imagine an external hard drive with a terabyte of child pornography on it. If a forensic scientist can demonstrate that the external hard drive belongs to the defendant who is being accused of possessing child pornography, then the direct evidence condition has been met.
For real evidence, let's assume that the defendant covered his external hard drive with a variety of stickers. Upon examination, the defendant plays dumb, but the prosecutor reveals that a search of his apartment found sheets of the same stickers that were on his hard drive. The characteristics of the hard drive, the stickers, would be good reason to believe that the hard drive belongs to the defendant.
Lastly, the original hard drive of the defendant or a forensic copy could satisfy the best evidence condition. Hashing the forensic copy can verify that the "image" (in the digital forensics sense, not necessarily a picture) is identical to the source media, which would mean that the forensic copy of the digital hard drive would satisfy the best evidence condition.